Skip to content

Latest commit

 

History

History
55 lines (31 loc) · 2.18 KB

061.md

File metadata and controls

55 lines (31 loc) · 2.18 KB

Striped Fiery Lark

High

Selling and buying nounce NFTs from marketplaces would be dangerous, thanks to the new mechanic

Summary

After the winner is selected, 20% of the bid goes strait to the DAO, and the rest is set to be streamed daily for up to 4 years. The final bidder, who receives the NFT can choose to cancelStream and refund all of the un-streamed ETH. This essentially means that NFTs would have some intrinsic value in ETH.

However when these NFTs are traded in different marketplaces, the user who owns the NFT would be able to manipulate and grief it's buyer by abusing fastForwardStream.

Example:

  1. User bids 10 ETH and wins the bid, 2 ETH is set directly to auction and 8 is streamed over 4 years
  2. After some time he decides to sell the NFT, while the NFT holds 7 ETH that are to be streamed
  3. There are a few bids. highest one is 7.1 ETH (7 ETH for the inherit value and 0.1 for the value of the NFT)
  4. He accepts the bid, but before that calls fastForwardStream to forward all 6.9 ETH (leaving very little to be streamed)

The seller receives 7.1 ETH and the buyer an NFT which would have been able to redeem for 7 ETH, but now only worth 0.1 (or less)

Root Cause

Users being able to change the value of an NFT, i.e. fastForwardStream

https://github.com/sherlock-audit/2024-11-nounsdao/blob/main/nouns-monorepo/packages/nouns-contracts/contracts/StreamEscrow.sol#L197-L224

Internal pre-conditions

none

External pre-conditions

none

Attack Path

  1. User bids 10 ETH and wins the bid, 2 ETH is set directly to auction and 8 is streamed over 4 years
  2. After some time he decides to sell the NFT, while the NFT holds 7 ETH that are to be streamed
  3. There are a few bids. highest one is 7.1 ETH (7 ETH for the inherit value and 0.1 for the value of the NFT)
  4. He accepts the bid, but before that calls fastForwardStream to forward all 6.9 ETH (leaving very little to be streamed)

The seller receives 7.1 ETH and the buyer an NFT which would have been able to redeem for 7 ETH, but now only worth 0.1 (or less)

Impact

User loses funds

PoC

No response

Mitigation

With the given codebase a simple fix would be hard to implement, best suggestion is